Day 25: Kerberoasting 2026 — Attack & Defend Service Account Passwords in Active Directory

This article from an ethical hacking course explains Kerberoasting, an Active Directory attack that allows any low-privilege domain user to request encrypted service tickets, crack them offline, and compromise service accounts—often those with elevated privileges. The technique appears in nearly every successful red team engagement because it requires minimal permissions, generates minimal logs, and exploits weak service account passwords that are manually set and rarely rotated. The article covers attack execution using Impacket's GetUserSPNs.py and Hashcat, target prioritization by privilege level, and defensive detection via Windows Event ID 4769 monitoring.

• Fundamental Kerberos authentication vulnerabilityThe Domain Controller issues Ticket Granting Service (TGS) tickets encrypted with the service account's NTLM password hash to any authenticated domain user who requests one, without access checks. This design flaw means attackers with only standard user credentials can request tickets for any SPN-registered service, then take those tickets offline for cracking—all without further DC interaction.
• Why service accounts are realistic targetsComputer accounts generate 120+ random character passwords that rotate every 30 days, making their TGS hashes computationally infeasible to crack. Service accounts use manually-set passwords that follow predictable patterns ('Company2019!', 'ServiceAcc#1'), which dictionary and mutation-based wordlists like rockyou.txt can crack in seconds, making service accounts the viable cracking targets.
• Attack execution with three commandsThe article demonstrates using GetUserSPNs.py to enumerate kerberoastable accounts via LDAP queries, requesting TGS tickets with the -request flag to extract $krb5tgs$23$ hashes, then cracking them with Hashcat mode 13100. All steps appear as normal AD operations—the attack succeeds only if service account passwords exist in the attacker's wordlist.
• Privilege-based target prioritizationExtracted accounts should be prioritized by group membership before investing cracking time. Domain Admins and Enterprise Admins yield immediate full domain compromise; SQL Server service accounts (svc_sql*) and backup operators often have over-privileged access for lateral movement. The article includes a real example where a printer scan account held Domain Admin privileges from 2016 and was cracked in four minutes.
• Detection via Event ID 4769 monitoringWindows Event ID 4769 logs Kerberos TGS requests; multiple 4769 events with RC4 encryption (etype 0x17) from a single source in a short time window indicate Kerberoasting. Tools default to RC4 for crackability, making RC4 detection signatures effective for identifying automated Kerberoasting attempts on Domain Controllers.
• Three-layer defense strategyThe article recommends: (1) Group Managed Service Accounts (gMSAs) that automatically rotate 240-character random passwords, eliminating offline cracking; (2) manually setting service passwords to 25+ random characters; (3) enforcing Event ID 4769 monitoring. Forcing AES-only encryption instead of RC4 also eliminates offline crackability by requiring service account password updates and msDS-SupportedEncryptionTypes attribute configuration.
• Minimal operational noise and logsRequesting service tickets is normal AD behavior, generating minimal suspicious logs during enumeration. The hash cracking happens entirely offline after ticket extraction, leaving no further DC interaction or noise. This combination of normal-appearing operations and offline cracking makes Kerberoasting difficult to detect during active exploitation without Event ID 4769 analysis.

Bottom line: Kerberoasting succeeds because any domain user can request service tickets for cracking offline, service accounts hold manually-set weak passwords following predictable patterns, and many service accounts retain escalated privileges from years past—making it a high-impact, low-noise attack that appears on every red team checklist. Defense requires Group Managed Service Accounts, strong random passwords, and Event ID 4769 monitoring for RC4-encrypted TGS requests.